CVE-2025-6772

CVE-2025-6772 is a critical path traversal vulnerability affecting eosphoros-ai db-gpt versions up to 0.7.2, specifically within the import_flow function of the /api/v2/serve/awel/flow/import file. This vulnerability allows an unauthenticated attacker to remotely manipulate the 'File' argument, potentially leading to unauthorized access to sensitive information. With a CVSS score of 7.5 (HIGH), it presents a significant risk due to its network-based attack vector and low attack complexity, requiring no user interaction. While public exploit disclosure exists, there is currently no evidence of active exploitation, nor are there readily available exploit modules in common frameworks like Metasploit or Nuclei, and it has garnered minimal community discussion or media coverage.